Learning path
Cloud Engineer learning path: everything to study, topic by topic
Comprehensive Cloud Engineer assessment covering cloud foundations, infrastructure provisioning, networking, security, cost optimization, and advanced multi-cloud architecture patterns.
Short answer
To learn Cloud Engineer, work through 7 modules and 34 topics in the order they build on each other. It starts with Cloud Foundations, then moves on to Infrastructure Provisioning and Cloud Networking. Use the map as a checklist, or measure your level and study only what is missing.
What you will study
Topics are grouped by module. Open one to see its objectives and key concepts.
1 · Cloud Foundations5 topics
Cloud Service Models (IaaS/PaaS/SaaS)
Understanding IaaS, PaaS, and SaaS models, shared responsibility, and choosing the right abstraction level for workloads
Objectives
- Distinguish IaaS, PaaS, and SaaS with concrete examples
- Apply the shared responsibility model to determine security boundaries
Key concepts
- IaaS
- PaaS
- SaaS
- shared responsibility model
- cloud-native vs lift-and-shift
- managed services
- serverless
IAM & Access Control
Identity and access management fundamentals: users, groups, roles, policies, least privilege, and multi-factor authentication
Objectives
- Design IAM policies following the principle of least privilege
- Configure role-based access for cross-account scenarios
Key concepts
- IAM users
- IAM groups
- IAM roles
- IAM policies
- least privilege
- MFA
- service accounts
- assume role
Networking (VPC/Subnets/Security Groups)
Virtual private clouds, subnet design, security groups, NACLs, and basic network architecture in cloud environments
Objectives
- Design a VPC with public and private subnets for a web application
- Configure security groups and NACLs for layered network security
Key concepts
- VPC
- subnets
- public vs private subnets
- security groups
- NACLs
- route tables
- internet gateway
- NAT gateway
Compute Services (EC2/VMs/Cloud Run)
Virtual machines, container-based compute, serverless functions, and choosing the right compute service for workloads
Objectives
- Select the appropriate compute service based on workload characteristics
- Compare serverless, container, and VM-based compute trade-offs
Key concepts
- EC2
- Azure VMs
- Lambda
- Cloud Functions
- Cloud Run
- Fargate
- instance types
- spot instances
Storage Services (S3/Blob/GCS)
Object storage, block storage, file storage, lifecycle policies, and storage class optimization across cloud providers
Objectives
- Choose the right storage type for different data access patterns
- Configure lifecycle policies and storage tiering for cost optimization
Key concepts
- S3
- Azure Blob Storage
- GCS
- EBS
- storage classes
- lifecycle policies
- versioning
- cross-region replication
2 · Infrastructure Provisioning5 topics
Terraform/CloudFormation/Bicep
Infrastructure as Code tools: HCL syntax, CloudFormation templates, Bicep, state management, and IaC workflows
Objectives
- Write infrastructure definitions using Terraform or CloudFormation
- Manage state files and remote backends for team collaboration
Key concepts
- HCL syntax
- Terraform providers
- CloudFormation stacks
- Bicep
- state management
- plan/apply workflow
- remote backends
- resource dependencies
Infrastructure Modules & Reusability
Composable infrastructure modules, versioning, registries, and DRY principles for scalable IaC codebases
Objectives
- Design reusable infrastructure modules with clean interfaces
- Version and publish modules for organizational reuse
Key concepts
- Terraform modules
- module registry
- input variables
- outputs
- module versioning
- nested stacks
- composition patterns
- module testing
Multi-Account/Project Strategy
AWS Organizations, Azure Management Groups, GCP folder hierarchy, account vending, and isolation boundaries
Objectives
- Design a multi-account strategy with proper isolation boundaries
- Implement account vending automation for self-service provisioning
Key concepts
- AWS Organizations
- Azure Management Groups
- GCP folders
- account vending
- OU structure
- SCPs
- cross-account roles
- blast radius isolation
Landing Zone Design
Cloud landing zones: network topology, identity federation, logging, guardrails, and baseline configurations for enterprise adoption
Objectives
- Design a landing zone with networking, identity, and logging baselines
- Implement guardrails that balance security with developer agility
Key concepts
- Control Tower
- Azure Landing Zones
- hub-spoke topology
- centralized logging
- identity federation
- guardrails
- baseline configurations
- shared services
Drift Detection & Compliance
Detecting infrastructure drift, policy-as-code enforcement, automated remediation, and compliance-as-code frameworks
Objectives
- Implement continuous drift detection across cloud accounts
- Enforce compliance policies using policy-as-code frameworks
Key concepts
- drift detection
- terraform plan diff
- Config rules
- Azure Policy
- OPA/Rego
- Sentinel
- automated remediation
- compliance-as-code
3 · Cloud Networking5 topics
Load Balancing & CDN
Application and network load balancers, CDN configuration, SSL termination, health checks, and traffic distribution
Objectives
- Choose between ALB, NLB, and GWLB for different workload types
- Configure CDN distributions with proper caching and invalidation
Key concepts
- ALB
- NLB
- CloudFront
- Azure Front Door
- SSL termination
- health checks
- target groups
- sticky sessions
VPN & Peering
Site-to-site VPN, VPC peering, transit gateways, and hybrid connectivity options for connecting on-premises to cloud
Objectives
- Design VPN connectivity for hybrid cloud architectures
- Compare peering vs transit gateway for multi-VPC environments
Key concepts
- site-to-site VPN
- client VPN
- VPC peering
- transit gateway
- Azure VNet peering
- BGP
- IPSec tunnels
- redundant connections
DNS & Traffic Routing
Cloud DNS services, routing policies, failover, geolocation routing, and health-check-based routing for global applications
Objectives
- Configure DNS routing policies for high availability and performance
- Implement failover routing with health checks for disaster recovery
Key concepts
- Route 53
- Azure DNS
- Cloud DNS
- weighted routing
- latency-based routing
- geolocation routing
- failover routing
- health checks
Private Connectivity (PrivateLink/Endpoints)
VPC endpoints, PrivateLink, private DNS, and keeping traffic off the public internet for security and compliance
Objectives
- Design private connectivity to cloud services without internet exposure
- Choose between gateway and interface endpoints based on requirements
Key concepts
- VPC endpoints
- PrivateLink
- interface endpoints
- gateway endpoints
- private DNS zones
- service endpoints
- Azure Private Link
- Private Service Connect
Multi-Region Networking
Global network architecture, inter-region connectivity, global accelerators, and latency-optimized traffic routing
Objectives
- Design multi-region network topologies for global applications
- Optimize traffic routing across regions for latency and compliance
Key concepts
- inter-region peering
- Global Accelerator
- Azure Traffic Manager
- cross-region load balancing
- backbone networks
- latency optimization
- data sovereignty
- regional failover
4 · Cloud Security5 topics
Encryption at Rest & Transit
KMS, envelope encryption, TLS/mTLS, certificate management, and key rotation strategies for cloud workloads
Objectives
- Implement encryption at rest using KMS with proper key management
- Configure TLS/mTLS for service-to-service communication
Key concepts
- KMS
- CMK
- envelope encryption
- TLS
- mTLS
- ACM
- certificate rotation
- SSE-KMS
Cloud Security Posture Management
CSPM tools, security benchmarks (CIS), misconfiguration detection, and continuous security monitoring
Objectives
- Set up CSPM tooling with CIS benchmark compliance checks
- Design automated remediation workflows for security findings
Key concepts
- Security Hub
- Defender for Cloud
- CIS benchmarks
- GuardDuty
- CloudTrail
- misconfiguration detection
- security findings
- remediation workflows
Network Segmentation
Micro-segmentation, zero-trust networking, firewall rules, WAF configuration, and defense-in-depth network design
Objectives
- Design defense-in-depth network architectures with micro-segmentation
- Configure WAF rules to protect web applications from common attacks
Key concepts
- micro-segmentation
- zero-trust networking
- WAF
- network firewall
- defense in depth
- east-west traffic
- north-south traffic
- lateral movement prevention
Compliance Automation (SOC2/HIPAA)
Automated compliance checks, audit logging, evidence collection, and continuous compliance monitoring for SOC 2, HIPAA, and PCI-DSS
Objectives
- Implement automated compliance monitoring mapped to SOC 2 controls
- Design audit logging and evidence collection pipelines
Key concepts
- SOC 2
- HIPAA
- PCI-DSS
- audit logging
- evidence collection
- AWS Config rules
- compliance frameworks
- automated reporting
Incident Response in Cloud
Cloud-native incident response, forensic readiness, containment strategies, and post-incident analysis in cloud environments
Objectives
- Design cloud incident response playbooks with containment procedures
- Implement forensic readiness with log preservation and snapshot capabilities
Key concepts
- incident response playbooks
- forensic readiness
- containment strategies
- snapshot isolation
- log preservation
- IOC detection
- NIST IR framework
- automated response
5 · Cost & Operations5 topics
Cost Monitoring & Budgets
Cloud cost dashboards, budget alerts, cost allocation, and anomaly detection for proactive cost management
Objectives
- Set up cost monitoring with budget alerts and anomaly detection
- Implement cost allocation using tagging strategies
Key concepts
- Cost Explorer
- Azure Cost Management
- budget alerts
- cost allocation tags
- anomaly detection
- billing dashboards
- usage reports
- cost forecasting
Rightsizing & Reserved Instances
Instance rightsizing, reserved instances, savings plans, spot instances, and committed use discounts for cost optimization
Objectives
- Analyze workloads for rightsizing opportunities using cloud-native tools
- Design a purchasing strategy combining reserved instances and spot
Key concepts
- rightsizing recommendations
- reserved instances
- savings plans
- spot instances
- committed use discounts
- utilization analysis
- Trusted Advisor
- Compute Optimizer
Tagging Strategy & Governance
Resource tagging standards, tag enforcement, governance policies, and organizational tagging frameworks for accountability
Objectives
- Design a tagging strategy that supports cost allocation and governance
- Enforce tagging compliance using automated policy checks
Key concepts
- tagging standards
- mandatory tags
- tag enforcement
- tag policies
- cost center mapping
- environment tags
- ownership tags
- automation tags
Auto-Scaling Strategies
Horizontal and vertical auto-scaling, scaling policies, predictive scaling, and scaling patterns for different workload types
Objectives
- Design auto-scaling policies that balance cost and performance
- Implement predictive scaling for workloads with known traffic patterns
Key concepts
- horizontal scaling
- vertical scaling
- target tracking
- step scaling
- predictive scaling
- cooldown periods
- scaling policies
- scheduled scaling
FinOps Practices
FinOps framework, showback/chargeback models, unit economics, cloud financial management culture, and optimization lifecycle
Objectives
- Establish a FinOps practice with showback and chargeback models
- Drive cost accountability through unit economics and team-level visibility
Key concepts
- FinOps framework
- showback
- chargeback
- unit economics
- cloud financial management
- FinOps lifecycle
- inform phase
- optimize phase
6 · Advanced Architecture4 topics
Multi-Cloud Strategy
Multi-cloud design patterns, abstraction layers, vendor lock-in mitigation, and when multi-cloud makes sense
Objectives
- Evaluate when multi-cloud strategy provides genuine business value
- Design abstraction layers that reduce vendor lock-in without over-engineering
Key concepts
- multi-cloud patterns
- cloud abstraction
- vendor lock-in
- Terraform multi-provider
- Kubernetes portability
- data portability
- cloud-agnostic design
- exit strategy
Disaster Recovery & Business Continuity
DR strategies (pilot light, warm standby, multi-site), RTO/RPO targets, backup strategies, and DR testing
Objectives
- Design DR architectures matching RTO/RPO requirements to cost constraints
- Plan and execute DR testing exercises with measurable outcomes
Key concepts
- pilot light
- warm standby
- multi-site active-active
- RTO
- RPO
- backup strategies
- DR testing
- failover automation
Hybrid Cloud Architecture
Hybrid cloud patterns, on-premises to cloud connectivity, data residency, workload placement, and edge computing integration
Objectives
- Design hybrid architectures that optimize workload placement across environments
- Implement consistent management across on-premises and cloud with Arc/Anthos
Key concepts
- hybrid cloud patterns
- on-premises connectivity
- data residency
- workload placement
- edge computing
- AWS Outposts
- Azure Arc
- Anthos
Cloud Migration Patterns
The 7 Rs of migration, migration assessment, wave planning, cutover strategies, and large-scale migration programs
Objectives
- Conduct migration assessments and categorize workloads using the 7 Rs
- Design large-scale migration programs with wave planning and rollback capabilities
Key concepts
- 7 Rs of migration
- rehost
- replatform
- refactor
- migration assessment
- wave planning
- cutover strategy
- migration factory
7 · Expert Practices5 topics
Cloud-Native Security Architecture
Designing cloud-native security using zero-trust, CSPM, shift-left security, and defense-in-depth across cloud environments
Objectives
- Design a cloud-native security architecture using CNAPP and zero-trust principles
- Implement shift-left security with automated posture management
Key concepts
- CSPM
- CWPP
- CNAPP
- zero-trust cloud
- immutable infrastructure
- secrets management
- cloud security posture
Well-Architected at Depth
Applying all six AWS Well-Architected Framework pillars in practice: reviewing workloads and driving improvements
Objectives
- Conduct Well-Architected Framework reviews and produce actionable improvement plans
- Design custom lenses for domain-specific architectural reviews
Key concepts
- 6 pillars
- Well-Architected Tool
- high-risk issues
- improvement plans
- custom lenses
- review process
- SDP
FinOps Practices & Cloud Cost Governance
Implementing FinOps discipline: cost allocation, budgets, anomaly detection, and cross-team financial accountability
Objectives
- Design a FinOps practice with inform, optimize, and operate phases
- Implement unit economics and cross-team cost accountability
Key concepts
- FinOps phases
- unit economics
- tagging strategy
- cost allocation
- showback/chargeback
- budget alerts
- commitment discounts
Cloud Governance & Policy-as-Code
Enforcing cloud governance at scale using policy-as-code tools (OPA, Sentinel, Config Rules) and governance frameworks
Objectives
- Implement policy-as-code with OPA or Sentinel for cloud governance
- Design drift detection and remediation workflows across a multi-account organization
Key concepts
- OPA/Rego
- Sentinel policies
- Config Rules
- compliance-as-code
- drift detection
- policy exemption workflows
- guardrail levels
Multi-Cloud Strategy Trade-offs
Evaluating and implementing multi-cloud strategies: workload placement, abstraction layers, and operational complexity
Objectives
- Evaluate multi-cloud strategies against organizational requirements and constraints
- Design workload placement and abstraction strategies that balance portability with cloud-native optimization
Key concepts
- vendor lock-in
- portability vs optimization
- cloud abstraction
- multi-cloud networking
- unified identity
- cost comparison
- egress costs
Levels: Junior, Mid, Senior, and Expert
Explain it in your own words
Graded by AI · no account · 1 questionNo options to guess from: you write, the AI grades against the topic's rubric and tells you what level your answer reads at.
Already studying Cloud Engineer?
The assessment measures topic by topic, and your plan skips what you already know.
Open to read. An account is only needed to be measured.
Frequently asked questions
Where should I start studying Cloud Engineer?
Start with Cloud Foundations: Cloud Service Models (IaaS/PaaS/SaaS), IAM & Access Control, and Networking (VPC/Subnets/Security Groups). The map orders topics by what they depend on, so each one prepares the next.
How long does a full Cloud Engineer assessment take?
A full assessment of this path takes about 50 minutes. Study time depends on where you start; a diagnostic shows which topics you can skip.
Do I need an account to use this page?
No. The map, objectives and key concepts are open. You only need an account to be measured, get your gap by topic and receive a plan.